ci2-android-6-1-perf/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-1-perf/syz-executor3974668687 <...> Warning: Permanently added '10.128.0.96' (ED25519) to the list of known hosts. execve("ci2-android-6-1-perf/syz-executor3974668687", ["ci2-android-6-1-perf/syz-executor3974668687"], 0x7ffdc5d826f0 /* 10 vars */) = 0 brk(NULL) = 0x55558aa63000 brk(0x55558aa63d40) = 0x55558aa63d40 arch_prctl(ARCH_SET_FS, 0x55558aa633c0) = 0 set_tid_address(0x55558aa63690) = 305 set_robust_list(0x55558aa636a0, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-1-perf/syz-executor3974668687", 4096) = 49 getrandom("\x80\x11\x2c\x4f\xc9\x3e\xd5\xbc", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x55558aa63d40 brk(0x55558aa84d40) = 0x55558aa84d40 brk(0x55558aa85000) = 0x55558aa85000 mprotect(0x7fd3a5e7a000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 write(1, "executing program\n", 18) = 18 bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_PERF_EVENT, insn_cnt=8, insns=0x200000000080, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 16, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET6_GETSOCKNAME, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, core_relo_cnt=0, fd_array=NULL, core_relos=NULL, core_relo_rec_size=0, log_true_size=0, prog_token_fd=0}, 148) = -1 EFAULT (Bad address) bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_STACK_TRACE, key_size=4, value_size=256, max_entries=3, map_flags=BPF_F_RDONLY|BPF_F_STACK_BUILD_ID, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0}, 80) = 3 bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_PERF_EVENT, insn_cnt=8, insns=0x200000000080, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 16, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET6_GETSOCKNAME, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, core_relo_cnt=0, fd_array=NULL, core_relos=NULL, core_relo_rec_size=0, log_true_size=0, prog_token_fd=0}, 148) = 4 executing program perf_event_open({type=PERF_TYPE_SOFTWARE, size=PERF_ATTR_SIZE_VER7, config=PERF_COUNT_SW_PAGE_FAULTS, sample_period=1024, sample_type=PERF_SAMPLE_IP|PERF_SAMPLE_TID|PERF_SAMPLE_TIME|PERF_SAMPLE_READ|PERF_SAMPLE_CALLCHAIN|PERF_SAMPLE_PERIOD|PERF_SAMPLE_STACK_USER|PERF_SAMPLE_WEIGHT|PERF_SAMPLE_TRANSACTION|PERF_SAMPLE_REGS_INTR, read_format=0, precise_ip=0 /* arbitrary skid */, ...}, 0, -1, -1, 0) = 5 ioctl(5, PERF_EVENT_IOC_SET_BPF, 4) = 0 socketpair(AF_UNIX, SOCK_SEQPACKET, 0, [6, 7]) = 0 [ 24.751075][ T28] audit: type=1400 audit(1789026905.404:64): avc: denied { execmem } for pid=305 comm="syz-executor397" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 24.770762][ T28] audit: type=1400 audit(1789026905.404:65): avc: denied { bpf } for pid=305 comm="syz-executor397" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 24.773176][ T305] ================================================================== [ 24.792577][ T28] audit: type=1400 audit(1789026905.404:66): avc: denied { prog_load } for pid=305 comm="syz-executor397" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 24.799557][ T305] BUG: KASAN: slab-out-of-bounds in stack_map_get_build_id_offset+0x833/0x9b0 [ 24.799620][ T305] Write of size 4 at addr ffff88811027c330 by task syz-executor397/305 [ 24.819109][ T28] audit: type=1400 audit(1789026905.404:67): avc: denied { map_create } for pid=305 comm="syz-executor397" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 24.827643][ T305] [ 24.827651][ T305] CPU: 1 PID: 305 Comm: syz-executor397 Not tainted syzkaller #0 [ 24.827668][ T305] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 24.827695][ T305] Call Trace: [ 24.836218][ T28] audit: type=1400 audit(1789026905.404:68): avc: denied { map_read } for pid=305 comm="syz-executor397" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 24.855155][ T305] [ 24.855169][ T305] __dump_stack+0x21/0x24 [ 24.855196][ T305] dump_stack_lvl+0x110/0x170 [ 24.857796][ T28] audit: type=1400 audit(1789026905.404:69): avc: denied { perfmon } for pid=305 comm="syz-executor397" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 24.865304][ T305] ? __cfi_dump_stack_lvl+0x8/0x8 [ 24.865335][ T305] ? bad_area_nosemaphore+0x2d/0x40 [ 24.865355][ T305] ? stack_map_get_build_id_offset+0x833/0x9b0 [ 24.875675][ T28] audit: type=1400 audit(1789026905.404:70): avc: denied { prog_run } for pid=305 comm="syz-executor397" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 24.878662][ T305] print_address_description+0x71/0x200 [ 24.897974][ T28] audit: type=1400 audit(1789026905.404:71): avc: denied { open } for pid=305 comm="syz-executor397" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 24.900660][ T305] print_report+0x4a/0x60 [ 24.905148][ T28] audit: type=1400 audit(1789026905.404:72): avc: denied { kernel } for pid=305 comm="syz-executor397" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 24.909629][ T305] kasan_report+0x122/0x150 [ 24.930854][ T28] audit: type=1400 audit(1789026905.434:73): avc: denied { write } for pid=305 comm="syz-executor397" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 24.935650][ T305] ? stack_map_get_build_id_offset+0x833/0x9b0 [ 24.935676][ T305] __asan_report_store4_noabort+0x17/0x20 [ 24.935692][ T305] stack_map_get_build_id_offset+0x833/0x9b0 [ 25.056516][ T305] ? _raw_spin_unlock+0x4c/0x70 [ 25.061382][ T305] ? __bpf_get_stackid+0x960/0x960 [ 25.066476][ T305] ? pcpu_freelist_pop+0xac/0xf0 [ 25.071399][ T305] ? __cfi_pcpu_freelist_pop+0x10/0x10 [ 25.076839][ T305] __bpf_get_stackid+0x5ac/0x960 [ 25.081795][ T305] bpf_get_stackid_pe+0x2ee/0x400 [ 25.086804][ T305] bpf_prog_2414a5d5030ea31b+0x21/0x25 [ 25.092281][ T305] bpf_overflow_handler+0x3c7/0x5e0 [ 25.097497][ T305] ? __cfi_bpf_overflow_handler+0x10/0x10 [ 25.103226][ T305] ? __this_cpu_preempt_check+0x13/0x20 [ 25.108775][ T305] ? __perf_event_account_interrupt+0x1a4/0x2c0 [ 25.115039][ T305] __perf_event_overflow+0x458/0x640 [ 25.120323][ T305] perf_swevent_event+0x243/0x440 [ 25.125339][ T305] ? perf_tp_event+0xa20/0xa20 [ 25.130103][ T305] ? __set_page_owner_handle+0x3c7/0x410 [ 25.135725][ T305] ___perf_sw_event+0x3bf/0x500 [ 25.140570][ T305] ? __cfi____perf_sw_event+0x10/0x10 [ 25.145932][ T305] ? prep_new_page+0x1c/0x110 [ 25.150605][ T305] ? __cfi_gfp_zone+0x10/0x10 [ 25.155275][ T305] __perf_sw_event+0x134/0x270 [ 25.160089][ T305] do_user_addr_fault+0xfe9/0x1030 [ 25.165194][ T305] exc_page_fault+0x51/0xb0 [ 25.169689][ T305] asm_exc_page_fault+0x27/0x30 [ 25.174529][ T305] RIP: 0010:copy_user_enhanced_fast_string+0xa/0x40 [ 25.181123][ T305] Code: ff c9 75 f2 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 01 ca c3 8d 0c ca 89 ca eb 20 0f 01 cb 83 fa 40 72 38 89 d1 a4 31 c0 0f 01 ca c3 89 ca eb 0a 90 90 90 90 90 90 90 90 90 90 [ 25.200819][ T305] RSP: 0018:ffffc90000dd75e0 EFLAGS: 00050206 [ 25.206887][ T305] RAX: ffffffff82675001 RBX: 0000000000002ed0 RCX: 0000000000001150 [ 25.214856][ T305] RDX: 0000000000002ed0 RSI: 0000200000002000 RDI: ffff8881103dde17 [ 25.222819][ T305] RBP: ffffc90000dd7610 R08: ffff8881103def66 R09: 1ffff1102207bdec [ 25.230787][ T305] R10: dffffc0000000000 R11: ffffed102207bded R12: 00007fffffffc130 [ 25.238755][ T305] R13: 0000000000002e00 R14: ffff8881103dc097 R15: 0000200000000280 [ 25.246721][ T305] ? _copy_from_iter+0xf51/0xfe0 [ 25.251661][ T305] ? copyin+0x82/0xa0 [ 25.255639][ T305] _copy_from_iter+0x4e1/0xfe0 [ 25.260522][ T305] ? __cfi__copy_from_iter+0x10/0x10 [ 25.265898][ T305] ? __cfi_avc_has_perm_noaudit+0x10/0x10 [ 25.271665][ T305] ? __kasan_check_read+0x11/0x20 [ 25.276688][ T305] ? __check_object_size+0x45a/0x600 [ 25.281970][ T305] skb_copy_datagram_from_iter+0xee/0x6b0 [ 25.287686][ T305] ? __cfi__raw_spin_lock+0x10/0x10 [ 25.292878][ T305] ? avc_has_perm+0x163/0x250 [ 25.297549][ T305] ? skb_put+0x10a/0x1f0 [ 25.301785][ T305] unix_dgram_sendmsg+0x683/0x1710 [ 25.306890][ T305] ? selinux_socket_sendmsg+0x22f/0x340 [ 25.312429][ T305] ? __cfi_merge_sched_in+0x10/0x10 [ 25.317621][ T305] ? __cfi_unix_dgram_sendmsg+0x10/0x10 [ 25.323166][ T305] ? sched_clock+0x9/0x10 [ 25.327500][ T305] unix_seqpacket_sendmsg+0x118/0x1e0 [ 25.332868][ T305] ? __cfi_unix_seqpacket_sendmsg+0x10/0x10 [ 25.338751][ T305] ____sys_sendmsg+0x5fb/0x9c0 [ 25.343550][ T305] ? __sys_sendmsg_sock+0x40/0x40 [ 25.348572][ T305] ? import_iovec+0x7c/0xb0 [ 25.353091][ T305] ___sys_sendmsg+0x2a2/0x360 [ 25.357765][ T305] ? __cfi___switch_to+0x10/0x10 [ 25.362703][ T305] ? __sys_sendmsg+0x290/0x290 [ 25.367461][ T305] ? finish_task_switch+0x16b/0x7c0 [ 25.372670][ T305] ? switch_mm_irqs_off+0x730/0x960 [ 25.377884][ T305] ? __kasan_check_write+0x14/0x20 [ 25.382998][ T305] ? __kasan_check_read+0x11/0x20 [ 25.388012][ T305] ? __fdget+0x15b/0x220 [ 25.392247][ T305] __x64_sys_sendmsg+0x20d/0x2e0 [ 25.397200][ T305] ? _raw_spin_unlock_irq+0x4d/0x70 [ 25.402395][ T305] ? __cfi___x64_sys_sendmsg+0x10/0x10 [ 25.407848][ T305] ? fpregs_restore_userregs+0x128/0x260 [ 25.413478][ T305] x64_sys_call+0x171/0x9a0 [ 25.417982][ T305] do_syscall_64+0x4c/0xa0 [ 25.422507][ T305] ? clear_bhb_loop+0x30/0x80 [ 25.427185][ T305] ? clear_bhb_loop+0x30/0x80 [ 25.431871][ T305] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 25.437754][ T305] RIP: 0033:0x7fd3a5dea179 [ 25.442170][ T305] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 25.461767][ T305] RSP: 002b:00007ffc105f7698 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 25.470176][ T305] RAX: ffffffffffffffda RBX: 00007ffc105f77c8 RCX: 00007fd3a5dea179 [ 25.478140][ T305] RDX: 0000000000000000 RSI: 0000200000000180 RDI: 0000000000000007 [ 25.486109][ T305] RBP: 0000000000000001 R08: 00007ffc105f77c8 R09: 00007ffc105f77c8 [ 25.494082][ T305] R10: 00007ffc105f77c8 R11: 0000000000000246 R12: 00007ffc105f77b8 [ 25.502053][ T305] R13: 0000000000000002 R14: 00007fd3a5e7aca0 R15: 0000000000000002 [ 25.510032][ T305] [ 25.513075][ T305] [ 25.515384][ T305] Allocated by task 305: [ 25.519602][ T305] kasan_set_track+0x4b/0x70 [ 25.524186][ T305] kasan_save_alloc_info+0x1f/0x30 [ 25.529292][ T305] __kasan_kmalloc+0x95/0xb0 [ 25.533873][ T305] __kmalloc_node+0xb2/0x1e0 [ 25.538452][ T305] bpf_map_area_alloc+0x4b/0xe0 [ 25.543296][ T305] prealloc_elems_and_freelist+0x8a/0x1e0 [ 25.549032][ T305] stack_map_alloc+0x398/0x520 [ 25.553817][ T305] map_create+0x467/0xcf0 [ 25.558134][ T305] __sys_bpf+0x34e/0x850 [ 25.562388][ T305] __x64_sys_bpf+0x7c/0x90 [ 25.566789][ T305] x64_sys_call+0x488/0x9a0 [ 25.571285][ T305] do_syscall_64+0x4c/0xa0 [ 25.575694][ T305] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 25.581573][ T305] [ 25.583883][ T305] The buggy address belongs to the object at ffff88811027c000 [ 25.583883][ T305] which belongs to the cache kmalloc-1k of size 1024 [ 25.597968][ T305] The buggy address is located 816 bytes inside of [ 25.597968][ T305] 1024-byte region [ffff88811027c000, ffff88811027c400) [ 25.611321][ T305] [ 25.613632][ T305] The buggy address belongs to the physical page: [ 25.620022][ T305] page:ffffea0004409e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x110278 [ 25.630278][ T305] head:ffffea0004409e00 order:3 compound_mapcount:0 compound_pincount:0 [ 25.638592][ T305] flags: 0x4000000000010200(slab|head|zone=1) [ 25.644668][ T305] raw: 4000000000010200 ffffea0004411200 dead000000000002 ffff888100043080 [ 25.653244][ T305] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 25.661811][ T305] page dumped because: kasan: bad access detected [ 25.668302][ T305] page_owner tracks the page as allocated [ 25.674086][ T305] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 92, tgid 92 (klogd), ts 4023788537, free_ts 0 [ 25.693522][ T305] post_alloc_hook+0x1f5/0x210 [ 25.698288][ T305] prep_new_page+0x1c/0x110 [ 25.702872][ T305] get_page_from_freelist+0x2ca9/0x2d20 [ 25.708415][ T305] __alloc_pages+0x1fa/0x610 [ 25.712997][ T305] alloc_slab_page+0x6e/0xf0 [ 25.717611][ T305] new_slab+0x98/0x3e0 [ 25.721666][ T305] ___slab_alloc+0x70f/0xb70 [ 25.726292][ T305] __slab_alloc+0x5e/0xa0 [ 25.730625][ T305] __kmem_cache_alloc_node+0x204/0x2d0 [ 25.736089][ T305] kmalloc_trace+0x29/0xb0 [ 25.740514][ T305] syslog_print+0x11f/0x600 [ 25.745008][ T305] do_syslog+0x6e1/0x7a0 [ 25.749246][ T305] __x64_sys_syslog+0x7c/0x90 [ 25.754101][ T305] x64_sys_call+0x610/0x9a0 [ 25.758612][ T305] do_syscall_64+0x4c/0xa0 [ 25.763026][ T305] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 25.768936][ T305] page_owner free stack trace missing [ 25.774293][ T305] [ 25.776605][ T305] Memory state around the buggy address: [ 25.782257][ T305] ffff88811027c200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 25.790309][ T305] ffff88811027c280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 sendmsg(7, {msg_name=NULL, msg_namelen=0, msg_iov=[{iov_base="\x25\xb0\x96\xf6\x81\xcd\x73\x1c\x3f\x3a\x9b\xad\xc4\xe3\xcf\x5e\xde\xae\x1f\x3b\x50\x82\xd7\xab\x3a\x97\xc0\x53\xdf\x68\x74\x4e\x7c\x7e\x24\xd0\xb5\x99\x97\xba\xb4\xbc\xcf\xf8\x36\x3b\x27\x5d\xe3\x51\x0b\x0e\xbe\x42\x75\xd8\xd2\xf1\x53\x39\x56\x68\xe3\xd6\x08\xe3\x58\xfc\x22\x94\x26\x3c\x03\xf8\xdc\x4f\x8b\xf1\x94\xe4\xfd\xe4\x60\x0a\x2d\xec\x2f\x48\x3a\x91\x4e\x2f\xde\x0c\xbc\x34\x4a\x2b\x9f\xc1"..., iov_len=151}, {iov_base="\xd3\xa8\x8b\xea\x59\x16\xe3\x13\x72\x9a\x39\x89\x39\x3c\xac\xa7\x0c\x74\xcd\x74\xe6\x2e\x52\x4b\xdd\x37\xbe\x13\x1a\xd8\x27\xf9\x11\x02\x7e\x70\xcc\xf6\x79\xd8\xe7\xc0\xcd\x33\x33\x09\x5f\x83\xd6\xd4\x73\xdb\x34\x5d\xed\x2a\xc8\xac\xaa\x87\x50\x3d\xe7\x4c\x82\x43\x17\x58\xe8\xe1\x1e\x3e\xcb\x7b\xce\x02\xd6\xcd\x65\xf4\xeb\x88\xcc\x49\xce\xb9\xe3\x9f\x71\x17\xeb\x0f\x62\x32\x3d\xc9\xb8\x0d\xea\x44"..., iov_len=65232}], msg_iovlen=2, msg_controllen=0, msg_flags=0}, 0) = 65383 exit_group(0) = ? +++ exited with 0 +++ [ 25.798375][ T305] >ffff88811027c300: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc